It is often desirable to control the accessibility of computer system resources that are accessible through networks such as LANs, WANs, and the Internet. Recently, security and access concerns have grown as malicious trespasses have increased the desirability to have improved access control. Further, the heightened state of awareness related to threats of cyber terrorism make the desire to reduce existing vulnerabilities greater than ever before.
A key to restricting access to network resources is the ability to distinguish between different users once they have been identified. Conventional methods involve creating a session identifier for a user once the user has been identified. If the client-server application is capable, the session identifier may be embedded in the application data that is sent back and forth between the client and server. One example of this is embedding a cookie in a web browser. Unfortunately, many applications were never designed to handle session identifiers and cannot practically be made to accommodate session identifiers. For such applications, present solutions relate to using the session identifier from the network address of the client. Unfortunately, network addresses are often overridden by network gateways, and as such, the reliability of this identifying information is substantially diminished.
FIG. 1 is a block diagram illustration of several users (i.e., User 1, User 2, and User 3 with network addresses 192.168.10.10, 192.168.10.11 and 192.168.10.12, respectively) communicating with a network through a common gateway 40 (i.e., 192.168.1.1). Because the gateway 40 overwrites the network addresses 192.168.10.10, 192.168.10.11 and 192.168.10.12 of the users 10, 20 and 30, respectively, with its own network address 192.168.1.1, the server 50 (i.e., having a network address 192.168.1.13) sees every user 10, 20 and 30 coming through the gateway 40 as having the same network address (i.e., 192.168.1.1).
In configurations where it is not possible or practical to place a session identifier in the client-server application, it would be desirable to provide a method of identifying an originator of a computer transaction that overcomes at least one of the above-described deficiencies.